Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 15:00

General

  • Target

    e2cc01f9e278119400e4894f1c7262fa_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    e2cc01f9e278119400e4894f1c7262fa

  • SHA1

    829942f7749fe8058d082ad3fc711182ca0cefca

  • SHA256

    c3adf3a04f27b2dab14b14b4849ff6f6562af277b2f2592770717489ab7e806a

  • SHA512

    164b351c73a58dfa99586663966023602e4e6d641a998839e9cc5e4552c139b0aa122d1e64f071598c51f82e24882447dbb160cf002da236cc23ce88a655945b

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm54

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2cc01f9e278119400e4894f1c7262fa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e2cc01f9e278119400e4894f1c7262fa_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Windows\SysWOW64\zheddmnpad.exe
      zheddmnpad.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4556
      • C:\Windows\SysWOW64\ozvmxwbq.exe
        C:\Windows\system32\ozvmxwbq.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4496
    • C:\Windows\SysWOW64\ccmphxjnuqxskhb.exe
      ccmphxjnuqxskhb.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3740
    • C:\Windows\SysWOW64\ozvmxwbq.exe
      ozvmxwbq.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2056
    • C:\Windows\SysWOW64\yazcwdejvqjhg.exe
      yazcwdejvqjhg.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4928
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    512KB

    MD5

    92b8da49db17d7be0f63e54a455a1391

    SHA1

    8501f386858bfc9556a528a17921dbe8bb754c6d

    SHA256

    2c44252e9c241c07a52da4b940dcb3d541fba2e6851907a00a10f9cc2b97b88a

    SHA512

    572dcce13fcb80365cb528640ef02b84ebe43221ec969874f4b3008a60103d867a6903f3441724b405ec41030799f196dd136a4bbc4ff15c1ebe04a9284093f3

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    512KB

    MD5

    a594c70919cdcda61b97fa59d320f767

    SHA1

    af89006937330e9487cb648f0202d7bf9d102b72

    SHA256

    3df30aefa0e6cc89b8acb53d2abeed46b20be1a31d4b9897011a377dc3d3b83d

    SHA512

    b8191372745dfe9ae8f80a59e3821dd6936e01041b2316db8bd035711e1ac9746c6586d362630d6d13582e5c86fd48f8329f987e31e5fa8df58e91fa7a476ffb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    fc157baa537015a38b9e29ee3bc770d6

    SHA1

    e2d35e841b852229ee0d2f006b1cda73b48d8b50

    SHA256

    51e5fc5824aaba1d8483930cbc7a6bdb7ca628c2fa29c5701281fea21b71e253

    SHA512

    864c1ebdccb87a3cc697f21b80bbd83a4932fe5f72350d88ca0b2a56f05af1b3511091351cd3205ff41109189854c89e36f322d07f85ae4cf64374be1550e73d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    fed9a545e591b9901eefac72cb516652

    SHA1

    0263c21e5d071c68052b78cc0846a1be958905ee

    SHA256

    a3c28a6d57a734d2618a827235243b7ac7c365e29dec0cb9d589b397738251b9

    SHA512

    5fee5b3b65e890513384119786e98289707f2864196f15039207bed86d03f454eb8bf58cb3a8e063cde4410cdb2493dc98dc2b78d2b2a46018ef1fb202cf763f

  • C:\Windows\SysWOW64\ccmphxjnuqxskhb.exe

    Filesize

    512KB

    MD5

    6f0ecef5026e43a63d213d08684bc0dd

    SHA1

    17bff1fd46450314acfc5e4dd1f4c7e7715933e0

    SHA256

    dde597fecc2f728857f811dd1eae9026268211f85be088a6d6bdc7b63be12fb5

    SHA512

    f229c866688172036f6a84adf483f6aa524bfaab7211611ce1aab49fa6eaf010f243b173370244e5975acc5f96aa3698b432bb46347f215ea4985031939f908a

  • C:\Windows\SysWOW64\ozvmxwbq.exe

    Filesize

    512KB

    MD5

    0db8095f8e91b69ede1be5cabee96437

    SHA1

    5134370084ce33857973b29122ea85e0be8062c9

    SHA256

    ecb25ce00b7b530788ae2ff6908fc53c117f6275067fa25dc476391414ef6562

    SHA512

    8d47976287b5c8fe4ffbf7658843c72d148ae769a3a0bffccf9a6be8e265d9613eb25024d66f0403f13de18b6bb7407caf0d69fcf9734eaceaf2111dfc6ecec2

  • C:\Windows\SysWOW64\yazcwdejvqjhg.exe

    Filesize

    512KB

    MD5

    e741e32217e2015bcf45bf664f24b943

    SHA1

    9e5ddf1da0c3e7d7bfaadd1475272c5d570a6490

    SHA256

    cacab44a827090f6f91d9eec7a02d2bbb43bf5be8fce562f54049ad5a4de39fa

    SHA512

    7d4a7dee4d6afda3baf4a8e652d7ce47953cf05569299bf545bf03a5d78e96be2f9dbcdda9c326430efee9bcdae3e68c737f66eee6c820820fb75f307df8334e

  • C:\Windows\SysWOW64\zheddmnpad.exe

    Filesize

    512KB

    MD5

    fa0278293033bd22b67ce25e6b669023

    SHA1

    2f81c3b1d1a1da3e11143a3540bd08474f25a649

    SHA256

    6a03ff8b0e2b2f3f6191c8c03779db94bf8d18a52a0537309447fa1d16c98980

    SHA512

    27157f91140b9ffb84059685e631269664fe860e928d1b47c12070dddf4919fba8f58f36344063865bc176a5339eed857bfc9f6c3403c4e472700d1aeb934c2a

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    71c8efe3bee2db633e9e9a32009bf1e2

    SHA1

    d95668e7b13c71e669a5939ac73d034c7695e1d1

    SHA256

    f1a2a281274a71d125697935362de61d1004853185b9befe8631c6cf9506c194

    SHA512

    fe7778acd4514ceceaed434d5bad970cdb7163d2bd0ef5df2f511d0fdfcb1cd5aa243100031707a540d0d604a43b2588f5d4d9094dcf539a883d51ee623bb3f1

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    e4bffcbb3c8d40fe7a1dfe176ed712ed

    SHA1

    93171aae82cbc83e7aa5310fbf36eb2cb06a92c9

    SHA256

    b0cdb1fb12445c8df73aeac88749b38271c43080ac6e35edf982e0e7b6cfe978

    SHA512

    114791810667508fb79d9da649916e85ebdef86470b014618bd9558397b9e9eccb631210ffd8ddb56590c49cf36ae140bf4b565fdd0dc44bb5cc5f101d92181d

  • memory/224-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

  • memory/1084-51-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-41-0x00007FF7E3290000-0x00007FF7E32A0000-memory.dmp

    Filesize

    64KB

  • memory/1084-47-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-48-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-49-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-50-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-52-0x00007FF7E0AD0000-0x00007FF7E0AE0000-memory.dmp

    Filesize

    64KB

  • memory/1084-43-0x00007FF7E3290000-0x00007FF7E32A0000-memory.dmp

    Filesize

    64KB

  • memory/1084-53-0x00007FF7E0AD0000-0x00007FF7E0AE0000-memory.dmp

    Filesize

    64KB

  • memory/1084-45-0x00007FF7E3290000-0x00007FF7E32A0000-memory.dmp

    Filesize

    64KB

  • memory/1084-44-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-42-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-40-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-46-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-39-0x00007FF7E3290000-0x00007FF7E32A0000-memory.dmp

    Filesize

    64KB

  • memory/1084-38-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-37-0x00007FF7E3290000-0x00007FF7E32A0000-memory.dmp

    Filesize

    64KB

  • memory/1084-109-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-110-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-111-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-133-0x00007FF7E3290000-0x00007FF7E32A0000-memory.dmp

    Filesize

    64KB

  • memory/1084-134-0x00007FF7E3290000-0x00007FF7E32A0000-memory.dmp

    Filesize

    64KB

  • memory/1084-135-0x00007FF7E3290000-0x00007FF7E32A0000-memory.dmp

    Filesize

    64KB

  • memory/1084-137-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-138-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-139-0x00007FF823210000-0x00007FF823405000-memory.dmp

    Filesize

    2.0MB

  • memory/1084-136-0x00007FF7E3290000-0x00007FF7E32A0000-memory.dmp

    Filesize

    64KB